Defense 16 November 2015 DISTRIBUTION STATEMENT A - APPROVAL FOR - PowerPoint PPT Presentation

Proposed Capability-Based Reference Architecture for Real-Time Network Defense 16 November 2015 DISTRIBUTION STATEMENT A - APPROVAL FOR PUBLIC RELEASE: DISTRIBUTION IS UNLIMITED Based on work funded by the Department of Homeland Security Gregg Tally Gregg.Tally@jhuapl.edu

Problem Statement  Current asymmetric advantage to the attackers  Tools support automation of the attack process vs. manual cyber defense operations  Attackers able to re-use tools and techniques across multiple targets vs. ad hoc information sharing by defenders  Cyber-attack response times are too slow  Human in the loop, limited analyst time  Large numbers of cyber events never analyzed

Pillars of A Cyber Ecosystem A Secure and Resilient Cyber Ecosystem: Integrated Goal Adaptive Cyber Integrated, Adaptable, Trustworthy Defense (IACD) Information Sharing Interoperability Automation An active cyber defense ecosystem Technical enabling near real- Framework time network defense at the enterprise level. Trusted information Assured Communications sharing and cyber services across Foundation Trust enterprises. Risk Management, Risk – Based Business Decisions

Goals  Use human capital for cyber operations more effectively within the community through automation.  Respond to cyber events as they occur through automated sensing, sense making, decision making, and response  Increase the number of cyber events in an enterprise that can be analyzed, thereby detecting intrusions earlier in the kill chain.  Degrade the attacker’s ability to re -use their wares across the community through enhanced information sharing.  Rapidly share and ingest threat information, analytics, and effective cyber event responses within the defender community.  Force attackers to develop new tools and techniques for each new target.  Remove barriers to adoption for the community through interoperability.  Create a market for security tools that emphasize machine-to-machine information exchange and interoperability.  Enable diverse but interoperable implementations of IACD, supporting a “bring your own enterprise” approach to integration.

IACD Constituent Capabilities  Trusted Cyber Services  Trust Services  Information/Data Management Services  Analytics, Reputation, and Enrichment Services  Shared Situational Awareness Services  Integrated Operational Action Services  Trusted Information Services  Indicators  Analytics  Courses of Action  Enterprise Automated Security Environment (EASE)  Enterprise Automation  Interoperability  Information Sharing

Reference Architecture Objectives 1. Encourage and provide guidelines for implementing security automation and information sharing in enterprises with diverse legacy architectures 2. Promote commercial adoption of standardized machine-to- machine interfaces by communicating IACD needs and requirements to vendors

Approach to the Reference Architecture  Capability-based approach  Focus on the required capabilities and interactions between them  Support many different vendor solutions  Acknowledge and support a “bring your own enterprise” model  Product-agnostic, plug-and-play architecture  Allow vendors to innovate  For each capability, specify the minimum functionality necessary to ensure the capability meets the functional objectives, including interoperability  Only specify the essential functions  Avoid tight coupling between components  Support multi-vendor solutions and simplify integration  Be as stateless as possible within a capability  Increase robustness of the solution and prevent resource exhaustion

Enterprise Automated Security Environment ( EASE) IACD Constituent Capabilities EASE Architectural Views Focus of briefing

Conceptual View Functionality Inside the Enterprise Presentation and Ops Services Presentation and Ops Services Visualization Analytics/Workflow Development Management Interface Actuator IFs Response Secure Orchestration, Control, Management Actions Boundary Response Protections Controllers COAs Repositories Bus Rules DM Engine Network Protections SM Analytic Analytics Framework Host Protections Data Feeds Sensing I/F Services Content Defense Services Control Message Infrastructure Information Sharing Infrastructure Sharing Infrastructure Trust Services: Security, Identity, Access Control 9

Conceptual View Across/Among Enterprises National/Global: NCCIC, GEOC, National Cyber Centers v Trusted Information Sharing v Regional: Sectors, EOCs, Communities v Trusted Information Sharing v v v v Local: Enterprise, 10 D/A, CIKR, B/P/C

Messaging View Centralized Control of Service Orchestration Approach Sensing /IF Sense Making Presentation & Boundary Protections Actuator I/F Analytic Ops Services Content Sensor Data Framework Network Analytics Protections S/A Control/Data Channels Host Protections Actuator Cmds Defense Services Response Actions Sensor Data, Status Shared Analytics Control Message Infrastructure Configuration Cyber Events Sensor Data Directives Secure Orchestration, Control, Management Response Actions, Course of Action Share Indicators Shared COAs, Indicators, Information Sharing Actions Analytics Enterprise Cyber Events, Sensor Data, Share COAs, Indicators Perimeter Shared COAs Shared Indicators Analytics Course of Action Repositories External External Data Sharing I/F Feeds Response Decision-Making Log Data Information Intel Controller Engine Sharing Community Configuration Infrastructure Trusted Cyber Services Data Channel Blackboard Trusted Information Sharing Content Community COAs Coordination COA Policy Channel Mission Models Trust Services: Security, Identity, Access Control

Messaging View Decentralized Control of Service Orchestration Approach Sensing /IF Sense Making Presentation & Boundary Protections Actuator I/F Analytic Ops Services Content Sensor Data Framework Network Analytics Protections S/A Control/Data Channels Host Protections Actuator Cmds Secure Orchestration, Secure Orchestration, Secure Orchestration, Control Control Control Defense Services Response Actions Sensor Data, All Messages Shared Analytics Configuration, not Configuration a component! Directives Cyber Events Sensor Data Control Message Infrastructure Message Bus Response Actions, Course of Action Share Shared COAs, Indicators, Information Sharing Actions Indicators Analytics Enterprise Perimeter Cyber Events, Share COAs, Indicators Shared Shared COAs Analytics Course of Action Indicators Repositories Secure Orchestration, Secure Orchestration, Secure Orchestration, External External Data Control Control Sharing I/F Control Feeds Response Decision-Making Log Data Information Intel Controller Engine Sharing Community Configuration Data Channel Infrastructure Trusted Cyber Services Blackboard Trusted Information Sharing Content Community COAs Coordination COA Policy Channel Mission Models Trust Services: Security, Identity, Access Control

Centralized vs. Decentralized (Hypotheses) Centralized Decentralized  Advantages  Advantages  Scalability – replicate stateless  Control logic easily managed in one component components to increase capacity  Existing Orchestrator products  Extensibility – add new satisfy functionality components as data producers  Central point of management or consumers  Disadvantages  Disadvantage  Potential bottleneck or  Management, debugging resource exhaustion at challenges centralized coordinator  Control Message Infrastructure  New services require must be high performance – all additional logic in centralized logic at the data consumers coordinator

Functional View Information Sharing * COAs, Analytics, Indicators, Recommended Actions Sense-Making Sensing Sensor/ Inputs Analytic Actuator Analyst Framework Interface External : Acting Points Third-party Services Intel Feeds Op. Analytics/ * Admin Indicators Indi- cators Sharing Repos Interface & Response * Models COAs, Intra IACD : Controller Recommended Trusted Cyber Services Actions Trusted Info. Services Decision- Analyst Making Secure Orchestration, Engine Control, Management Op. Auth Control Message Infrastructure Trust Services

Functional View Sensor Actuator Interface Sensors and actuators have translators and managers that bridge the proprietary interfaces ( Raw Sensor Data ) to the standard Control Message Infrastructure format ( Sensor Data ) Op. Admin Status Info Sensor/ Actuator Control Sensor/ Sensor/ Actuator Actuator Raw Sensor Data Translator Manager Sensor Data S/A Publisher Sensor/Actuator Control Info

Functional View Sense Making Analytic Framework Evaluators use analytics to assess Sensor Data against Intel Data , determine if a Cyber Event has Cyber Event occurred Sensor Data, Intel Data Analytic Evaluator Intel Repo Update Rule Set Analyst I/O Analytics Shared Analytic Manager

Functional View Decision-Making Engine Given a Cyber Event , DM-Engine determines a course of action ( COA ) to minimize risk while considering mission impact of the alternative COAs Cyber Event Subscription Feed Mission Manager Mission Op. Inference Engine Auth Models I/O Repo Operations Op. Auth. Authority Selection I/O COA Policy Selector COA Manager Model COA Policy Update COA Selection Notice